Linux sends ICMP Echo with 56-byte payload + 8-byte header = 64 bytes total. Windows uses 32 bytes. NDR systems fingerprint hosts by these defaults — before any exploit lands. This post shows how to mimic any OS at the raw socket level.